CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php save_user sql injection6.9 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System cust_edit.php sql injection5.3 Medium
- shenzhen gongji technology xbrother dynamic environment monitoring systemShenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System plansImmediate PlanController.getImmediatePlans sql injection6.9 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System processlogin.php sql injection6.9 Medium
- code-projects barangay resident profiling management systemcode-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection6.9 Medium
- itsourcecode hospital management system project in phpitsourcecode Hospital Management System Project in PHP viewservicetype.php sql injection5.3 Medium
- cyber-iii student-management-systemsambitraj Student-Management-System Management Mutation sql injection5.3 Medium
- cyber-iii student-management-systemsambitraj Student-Management-System Dashboard sql injection5.3 Medium
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.29.3 Critical
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.29.3 Critical
- geotoolsGeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers9.8 Critical
- yootheme.com yootheme pro extension for joomlaJoomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.408.6 High
- david lingren media library assistantMedia Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector6.8 Medium
- unknown link whisper freeLink Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter6.8 Medium
- sourcecodester dynamic input field generator using html, css, and phpSourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection5.3 Medium
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability9.9 Critical
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability9.9 Critical
- bigbluebuttonBigBlueButton: Blind SQL Injection AUTH (Moderator)8.5 High
- fleetdm fleetFleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints2.3 Low
- fleetdm fleetFleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database7.6 High
- itsourcecode hospital management systemitsourcecode Hospital Management System viewappointmentpending.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System password-recovery.php sql injection6.9 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System forgotpw.php sql injection6.9 Medium
- apache inlongApache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService9.8 Critical
- apache inlongApache InLong: SQL Injection via String Concatenation Vulnerability Report9.8 Critical
- apache inlongApache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint9.8 Critical
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php delete_category sql injection6.9 Medium
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php save_category sql injection5.3 Medium
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System view_order.php sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewappointmentapproved.php sql injection5.3 Medium
- baserproject basercmsbaserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php8.6 High
- code-projects simple inventory systemcode-projects Simple Inventory System delete.php sql injection6.9 Medium
- infinitewp client, revmakx infinitewp client +1 moreWordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability7.6 High
- eshipper commerce, wordpress.com eshipper commerce +1 moreWordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability8.5 High
- axew3 wp w3all phpbbWordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability8.5 High
- repute infosystems bookingpress appointment booking proWordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability9.3 Critical
- plainware locatoraid store locatorWordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability9.3 Critical
- e-plugins directory proWordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability9.3 Critical
- codexthemes thegem (elementor)WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability9.3 Critical
- lukeseager wordpress persistent loginWordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability8.5 High
- cleantalk security & malware scan by cleantalkWordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability9.3 Critical
- rtcamp rtmedia for wordpress, buddypress and bbpressWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability9.3 Critical
- themegoods capellaWordPress Capella theme <= 2.5.5 - SQL Injection vulnerability9.3 Critical
- n8nn8n before 1.123.69 PostgREST Filter Injection via Supabase7.1 High
- amirsanni mini-inventory-and-sales-management-systemamirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection5.3 Medium
- No product listedDeDeCMS advancedsearch.php sql injection6.9 Medium
- code-projects employee management systemcode-projects Employee Management System Admin Login Endpoint aprocess.php sql injection6.9 Medium
- code-projects assessment managementcode-projects Assessment Management welcome.php sql injection6.9 Medium
- splunk soarStructured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR6.5 Medium
- splunk, splunk enterprise +1 moreStructured Query Language (SQL) Injection through the REST API in Splunk Enterprise6.5 Medium
- Show moreLoading…